ManageEngine EventLog Analyzer CVE-2026-92905

Exploitation requires network access to the product's syslog collection listener, which is enabled in normal deployments since syslog ingestion is a core function of EventLog Analyzer/Log360 - so this is effectively the default operating mode rather than a special configuration. No authentication or user interaction is needed (PR:N/UI:N), consistent with unauthenticated UDP/TCP syslog reception. Limiting factors: impact is confined to a denial of service against the log collector (A:L only, no C/I impact and no code execution), and reachability depends on whether the syslog port is exposed to the attacker's network segment; instances with the collector restricted to trusted internal sources are far less exposed.

This is a genuine but limited-severity availability issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: a remote, unauthenticated attacker sends malformed syslog packets over the network to crash the log collector, with no confidentiality or integrity impact and only partial (A:L) availability loss confined to the log-collection component rather than the whole host. No EPSS score, no CISA KEV listing, and no public POC were provided, so all three exploitation signals point to no confirmed real-world exploitation. The CWE-248 (uncaught exception) root cause matches a crash-on-malformed-input DoS. The realistic risk is degradation of security telemetry: crashing a SIEM/log collector can create a blind spot that masks other attacker activity, which raises its operational importance above the raw 5.3 for defenders who depend on this pipeline. No signals are conflicting; the main caveat is that severity rests solely on vendor self-reporting with no independent corroboration.

An attacker with network reachability to the syslog listener sends specially malformed syslog packets to the ManageEngine EventLog Analyzer/Log360 collector, triggering an uncaught exception that crashes the log collector. This creates a logging blind spot that can mask concurrent malicious activity. No public exploit code has been identified at time of analysis.